News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Articles per day, last 14 days
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
- Closed-day average
Show as tableHide table
| Day | Articles | On CISA KEV CVEs |
|---|---|---|
| Wed 14 Oct | 86 | 25 |
| Thu 15 Oct | 78 | 15 |
| Fri 16 Oct | 61 | 12 |
| Sat 17 Oct | 10 | 1 |
| Sun 18 Oct | 10 | 0 |
| Mon 19 Oct | 60 | 12 |
| Tue 20 Oct | 86 | 16 |
| Wed 21 Oct | 96 | 18 |
| Thu 22 Oct | 84 | 11 |
| Fri 23 Oct | 68 | 16 |
| Sat 24 Oct | 13 | 4 |
| Sun 25 Oct | 13 | 2 |
| Mon 26 Oct | 76 | 20 |
| Tue 27 Oct | 95 | 18 |
| Today, Wed 28 Oct | 80 so far | 15 |
Developing
Tue 13 May 202592 articles
- Sharing Intelligence Beyond CTI Teams, Across Wider Functions and Departments
CTI, digital brand protection and other cyber risk initiatives shouldn’t only be utilized by security and cyber teams.
SecurityWeek - Zoom Workplace Apps Flaws Allow Hackers to Gain Elevated Access
Zoom has released multiple security bulletins addressing seven newly discovered vulnerabilities in Zoom Workplace Apps, with one rated as high severity. All vulnerabilities were disclosed on May 13, 2025, and could potentially allow attackers to escalate…
gbhackers.com - PoC Exploit Published for macOS Sandbox Escape Vulnerability (CVE-2025-31258)
Security researchers have disclosed a new macOS sandbox escape vulnerability tracked as CVE-2025-31258, accompanied by a proof-of-concept (PoC) exploit demonstrating partial sandbox bypass via Apple’s RemoteViewServices framework. The flaw, discovered by…
gbhackers.com - Four Hackers Caught Exploiting Old Routers as Proxy Servers
U.S. authorities unsealed charges against four foreign nationals accused of operating a global cybercrime scheme that hijacked outdated wireless routers to create malicious proxy networks. Russian nationals Alexey Viktorovich Chertkov (37), Kirill…
gbhackers.com - F5 BIG-IP Vulnerability Allows Remote Command Execution
Critical security vulnerability in F5 BIG-IP systems has been discovered that allows authenticated administrators to execute arbitrary system commands, effectively bypassing security boundaries. Identified as CVE-2025-31644, the command injection flaw…
gbhackers.com - SAP Patches Another Critical NetWeaver Vulnerability
SAP has released 16 new security notes on its May 2025 Security Patch Day, including a note dealing with another critical NetWeaver vulnerability.
SecurityWeek - Scattered Spider Launches Supply Chain Attacks on UK Retail Organizations
Scattered Spider, also known as Roasting 0ktapus and Scatter Swine, has emerged as a formidable threat actor targeting UK retail organizations. Active since May 2022, this financially motivated group has historically focused on telecommunications and…
gbhackers.com - Building Effective Security Programs Requires Strategy, Patience, and Clear Vision
Capital One executives share insights on how organizations should design their security program, implement passwordless, and reduce their attack surface.
Dark Reading - Radware Says Recently Disclosed WAF Bypasses Were Patched in 2023
The Radware Cloud WAF product vulnerabilities disclosed by CERT/CC were addressed two years ago.
SecurityWeek - Moldovan Police arrested a 45-year-old foreign man participating in ransomware attacks on Dutch companies
A 45-year-old foreign man has been arrested in Moldova for allegedly participating in ransomware attacks on Dutch companies in 2021. Moldovan police arrested a 45-year-old foreign man as a result of a joint international operation involving Moldovan and…
Security Affairs - Revolutionizing OT risk prioritization with Darktrace 6.3
Darktrace / OT introduces IEC-62443 compliance reporting, expanded protocol visibility, and dynamic risk modeling, redefining how OT teams prioritize risks with contextual insights now additionally powered by firewall rule analysis and KEV scoring, all…
darktrace.com - Hackers Abuse PyInstaller to Deploy Stealthy macOS Infostealer
Jamf Threat Labs has identified a novel macOS infostealer that exploits PyInstaller, a legitimate open-source tool used to bundle Python scripts into standalone Mach-O executables. This marks the first documented instance of PyInstaller being weaponized to…
gbhackers.com - Marks & Spencer Says Data Stolen in Ransomware Attack
Marks & Spencer has confirmed that personal information was stolen in a recent cyberattack claimed by a ransomware group.
SecurityWeek - Moldovan Police Arrest Suspect in €4.5M Ransomware Attack on Dutch Research Agency
Ravie Lakshmanan reports: Moldovan law enforcement authorities have arrested a 45-year-old foreign man suspected of involvement in a series of ransomware attacks targeting Dutch companies in 2021. “He is wanted internationally for committing several…
DataBreaches - N.W.T.’s medical record system under the microscope after 2 reported cases of snooping
Sidney Cohen reports that both cases involved employees of the Northwest Territories Health and Social Services Authority: Medical records are among the most sensitive pieces of information that a government agency keeps on citizens. But these records are…
DataBreaches - Deepfake Defense in the Age of AI
The cybersecurity landscape has been dramatically reshaped by the advent of generative AI. Attackers now leverage large language models (LLMs) to impersonate trusted individuals and automate these social engineering tactics at scale. Let’s review the status…
The Hacker News - Output Messenger Zero-Day Exploited by Turkish Hackers for Iraq Spying
A Turkey-affiliated espionage group has exploited a zero-day vulnerability in Output Messenger since April 2024.
SecurityWeek - North Korean Konni APT Targets Ukraine with Malware to track Russian Invasion Progress
The North Korea-linked threat actor known as Konni APT has been attributed to a phishing campaign targeting government entities in Ukraine, indicating the threat actor's targeting beyond Russia. Enterprise security firm Proofpoint said the end goal of the…
The Hacker News - APT group exploited Output Messenger Zero-Day to target Kurdish military operating in Iraq
A Türkiye-linked group used an Output Messenger zero-day to spy on Kurdish military targets in Iraq, collecting user data since April 2024. Since April 2024, the threat actor Marbled Dust (aka Sea Turtle, Teal Kurma, Marbled Dust, SILICON and Cosmic Wolf)…
Security Affairs - PupkinStealer Targets Windows Users to Steal Browser Login Credentials
A newly identified information-stealing malware dubbed PupkinStealer has emerged as a significant threat to Windows users, with its first sightings reported in April 2025. Written in C# using the .NET framework, this malicious software is engineered to…
gbhackers.com - Repeated Firmware Key-Management Failures Undermine Intel Boot Guard and UEFI Secure Boot
The security of fundamental technologies like Intel Boot Guard and UEFI Secure Boot has been seriously questioned due to persistent cryptographic key management issues within the UEFI firmware ecosystem, which have been exposed in a number of concerning…
gbhackers.com - INE Security Alert: Top 5 Takeaways from RSAC 2025
Comprehensive Training Platform Delivers Solutions for AI Security, Cloud Management, and Incident Response Readiness. Fresh from a high-impact presence at RSAC 2025, where INE Security welcomed thousands of visitors to its interactive booth at San…
gbhackers.com - CISA Flags Hidden Functionality Flaw in TeleMessage TM SGNL on KEV List
Cybersecurity and Infrastructure Security Agency (CISA) has escalated its advisory for TeleMessage TM SGNL, adding a critical hidden functionality vulnerability (CVE-2025-47729) to its Known Exploited Vulnerabilities (KEV) catalog. This flaw exposes…
gbhackers.com - Asus One-Click Flaw Exposes Users to Remote Code Execution Attacks
Critical security vulnerability in ASUS DriverHub software has been discovered that allowed attackers to execute arbitrary code with administrator privileges through a simple web visit. Security researcher identified and reported the vulnerability in April…
gbhackers.com - Suspected DoppelPaymer Ransomware Group Member Arrested
A 45-year-old individual was arrested in Moldova for his suspected involvement in DoppelPaymer ransomware attacks.
SecurityWeek - Using a Mythic agent to optimize penetration testing
Introduction The way threat actors use post-exploitation frameworks in their attacks is a topic we frequently discuss. It’s not just about analysis of artifacts for us, though. Our company’s deep expertise means we can study these tools to implement best…
securelist.com - Orca Snaps Up Opus in Cloud Security Automation Push
Orca positioned the deal as an expansion of its capabilities into the realm of AI-based autonomous remediation and prevention.
SecurityWeek - Google Quietly Updates Logo with Gradient Colors Before Google I/O
In the days leading up to Google I/O 2025, Google has quietly unveiled a subtle redesign of its
SecurityOnline - Dior China Discloses Customer Data Breach After Unauthorized Access
French luxury brand Dior recently sent SMS notifications to its customers in China, disclosing a data breach incident.
SecurityOnline - North Korea's TA406 Targets Ukraine for Intel
The threat group's goal is to help Pyongyang assess risk to its troops deployed in Ukraine and to figure out if Moscow might want more.
Dark Reading - CISA Warns of Flaw in TeleMessage App Used by Ex-National Security Advisor
An information exposure flaw in TeleMessage has been added to CISA’s Known Exploited Vulnerabilities catalog.
SecurityWeek - macOS 16 to Get iOS-Style Clipboard Permissions for Enhanced Privacy
Since the release of iOS 14, Apple has implemented restrictions on clipboard access within iPhones. By default, when
SecurityOnline - Researchers Uncover Remote IT Job Fraud Scheme Involving North Korean Nationals
The United States indicted fourteen North Korean nationals for orchestrating a sophisticated scheme to secure remote IT jobs at American companies and nonprofits using stolen identities. This operation, which has funneled at least $88 million USD to the…
gbhackers.com - Attackers Leverage Unpatched Output Messenger 0‑Day to Deliver Malicious Payloads
A Türkiye-affiliated espionage threat actor, tracked by Microsoft Threat Intelligence as Marbled Dust (also known as Sea Turtle and UNC1326), has been exploiting a zero-day vulnerability in Output Messenger, a popular multiplatform chat software. Identified…
gbhackers.com - Cobalt Strike 4.11.1 Released With SSL Checkbox Fix
Cobalt Strike has announced the release of version 4.11.1, an out-of-band update addressing several critical issues discovered in the previous 4.11 release. The update primarily fixes a module stomping issue that could cause system crashes in specific…
gbhackers.com - SAP Security Alert: May 2025 Patch Day Exposes Critical Threats!
Today, 2025, SAP released 16 new Security Notes and updated 2 previously released ones as part of its
SecurityOnline - Moldovan Police Arrest Suspect in €4.5M Ransomware Attack on Dutch Research Agency
Moldovan law enforcement authorities have arrested a 45-year-old foreign man suspected of involvement in a series of ransomware attacks targeting Dutch companies in 2021. "He is wanted internationally for committing several cybercrimes (ransomware attacks,…
The Hacker News - Apple Releases Security Patches to Fix Critical Data Exposure Flaws
Apple released critical security updates for macOS Sequoia 15.5 on May 12, 2025, addressing over 40 vulnerabilities across system components ranging from kernel-level memory corruption risks to app sandbox escapes. The patches target flaws that could allow…
gbhackers.com - Apple released security updates to fix multiple flaws in iOS and macOS
Apple released security updates to address easily exploitable vulnerabilities impacting iOS and macOS devices. Apple released urgent iOS and macOS security updates to patch critical flaws that could allow attackers to execute malicious code just by opening a…
Security Affairs - Türkiye Hackers Exploited Output Messenger Zero-Day to Drop Golang Backdoors on Kurdish Servers
A Türkiye-affiliated threat actor exploited a zero-day security flaw in an Indian enterprise communication platform called Output Messenger as part of a cyber espionage attack campaign since April 2024. "These exploits have resulted in a collection of…
The Hacker News